CmReplaceKey

NTSTATUS __stdcall CmReplaceKey(_HHIVE *Hive, UINT64 Cell, _UNICODE_STRING *NewHiveName, _UNICODE_STRING *OldFileName){
  char v7; 
  char v8; 
  struct _PRIVILEGE_SET *v9; 
  struct _PRIVILEGE_SET *v10; 
  NTSTATUS v11; 
  int v12; 
  ULONG_PTR v13; 
  EVENT_DESCRIPTOR *v14; 
  char v16[8]; 
  ULONG_PTR BugCheckParameter2; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  KAPC_STATE ApcState; 
  _UNICODE_STRING ObjectInformation[32]; 
  v16[0] = 0;
  BugCheckParameter2 = 0i64;
  IoStatusBlock = 0i64;
  v7 = 0;
  v8 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  CmpAllocateTransientPoolWithTag((_HHIVE *)1, 0x1B0ui64, 0x33394D43ui64, (_CHILD_LIST *)OldFileName);
  v10 = v9;
  if( !v9 )
    return -1073741670;
  v12 = CmpCmdHiveOpen(NewHiveName, 0, v16, &BugCheckParameter2, 0x1100001u, 0, 0i64, 0i64, v9);
  v13 = BugCheckParameter2;
  v11 = v12;
  if( v12 >= 0 )
  {
    CmpAttachToRegistryProcess(&ApcState);
    v7 = 1;
    CmpLockRegistry();
    HvLockHiveFlusherExclusive((INT64)Hive);
    if( (Hive->HiveFlags & 4) != 0 )
    {
LABEL_5:
      v11 = -1073741611;
      goto LABEL_18;
    }
    if( (Hive[2].Storage[1].FreeDisplay[6].RealVectorSize & 0x20) != 0 )
      goto LABEL_7;
    if( Hive == (_HHIVE *)::Hive )
    {
      v11 = CmpPreserveSystemHiveData((UINT64)Hive, v13);
      if( v11 < 0 )
      {
LABEL_18:
        HvUnlockHiveFlusherExclusive((INT64)Hive);
        CmpUnlockRegistry();
        if( v8 )
          CmpFinishBeingActiveFlusherAndReconciler((__int64)Hive);
        goto LABEL_20;
      }
    }
    HvUnlockHiveFlusherExclusive((INT64)Hive);
    CmpUnlockRegistry();
    v11 = CmpFlushHive(v13, 12, v14);
    if( v11 >= 0 )
    {
      CmpDetachFromRegistryProcess(&ApcState);
      v7 = 0;
      CmpBecomeActiveFlusherAndReconciler((__int64)Hive);
      v8 = 1;
      CmpLockRegistry();
      HvLockHiveFlusherExclusive((INT64)Hive);
      if( (Hive->HiveFlags & 4) != 0 )
        goto LABEL_5;
      if( (Hive[2].Storage[1].FreeDisplay[6].RealVectorSize & 0x20) == 0 )
      {
        v11 = CmpCmdRenameHive(
                *(PVOID *)&Hive[1].Signature,
                (_OBJECT_NAME_INFORMATION *)ObjectInformation,
                OldFileName,
                0x200ui64,
                0);
        if( v11 >= 0 )
        {
          Hive->HiveFlags |= 4u;
          v11 = CmpCmdRenameHive(*(PVOID *)(v13 + 1536), 0i64, ObjectInformation, 0i64, 0);
          if( v11 < 0 || (v11 = ZwFlushBuffersFile(*(PVOID *)(v13 + 1536), &IoStatusBlock), v11 < 0) )
          {
            if( CmpCmdRenameHive(*(PVOID *)&Hive[1].Signature, 0i64, ObjectInformation, 0i64, 0) < 0 )
              v11 = -1073741492;
          }
        }
        goto LABEL_18;
      }
LABEL_7:
      v11 = -1073741811;
      goto LABEL_18;
    }
  }
LABEL_20:
  if( v13 )
  {
    if( !v7 )
    {
      CmpAttachToRegistryProcess(&ApcState);
      v7 = 1;
    }
    if( v11 >= 0 )
    {
      *(_OWORD *)(v13 + 1536) = 0i64;
      *(_OWORD *)(v13 + 1552) = 0i64;
      *(_OWORD *)(v13 + 1568) = 0i64;
    }
    CmpDestroyHive((PVOID)v13);
  }
  if( v7 )
    CmpDetachFromRegistryProcess(&ApcState);
  CmSiFreeMemory(v10);
  return v11;
}

Referenced by: